Analysis
- max time kernel
104s - max time network
106s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system - submitted
25/04/2025, 04:07
Behavioral task
behavioral1
Sample
2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe
Resource
win11-20250410-en
windows11-21h2-x64
18 signatures
150 seconds
General
- Target 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe
- Size 1.4MB
- Sample250425-epssdssqv8
- SHA256 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f
- MD5 084deb26cd9d8eff3f972e8e0c4adfe6
- SHA1 6de400edd829ef2195d09f6ae3de2fd586aefe14
- SHA512 adf9b1e47e0bc9c8699f31df3b30e7b14e0884e538ca565b1b50d87d1179e1f447a15e347fcf5dbae01b8b30a1193b9e01eb299b9ce3cada331aa048af8e4796
- SSDEEP 24576:e4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yRX3K:eo5+fFqgdh02q3ntgNLqw9nwPDC7bODB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\ProgramData\Adobe\README.txt
Ransom Note
- --= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 77565753618715415149 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion
URLs
-
http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion
-
http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion
-
http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion
-
http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion
-
http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion
-
http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion
-
http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion
Signatures
- Detect Neshta payload 4 IoCs
resource yara_rule behavioral2/files/0x0006000000027af9-945.dat family_neshta behavioral2/memory/1064-1129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1064-1130-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1064-1132-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- VanHelsing
VanHelsing ransomware was first observed in March 2025.
- Vanhelsing family
- Renames multiple (274) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 5684 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1492919288-2219487354-2015056034-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\Web\\vhlocker.png" 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\elevated_tracing_service.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\BHO\ie_to_edge_stub.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\cookie_exporter.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\pwahelper.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\INSTAL~1\setup.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\msedgewebview2.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\msedge_proxy.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\msedge.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\elevation_service.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MICROS~4.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MICROS~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MIA062~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Google\GOOGLE~1\134069~1.0\DISABL~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MI391D~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\msedge_pwa_launcher.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.43\MICROS~2.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\PWAHEL~1.EXE 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\133030~1.69\identity_helper.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File created C:\Windows\Web\vhlocker.png 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe File created C:\Windows\Web\vhlocker.ico 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.vanlocker\DefaultIcon 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker\DefaultIcon 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker\DefaultIcon\ = "C:\\Windows\\Web\\vhlocker.ico" 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5684 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe Token: SeBackupPrivilege 4256 vssvc.exe Token: SeRestorePrivilege 4256 vssvc.exe Token: SeAuditPrivilege 4256 vssvc.exe Token: SeIncreaseQuotaPrivilege 1052 WMIC.exe Token: SeSecurityPrivilege 1052 WMIC.exe Token: SeTakeOwnershipPrivilege 1052 WMIC.exe Token: SeLoadDriverPrivilege 1052 WMIC.exe Token: SeSystemProfilePrivilege 1052 WMIC.exe Token: SeSystemtimePrivilege 1052 WMIC.exe Token: SeProfSingleProcessPrivilege 1052 WMIC.exe Token: SeIncBasePriorityPrivilege 1052 WMIC.exe Token: SeCreatePagefilePrivilege 1052 WMIC.exe Token: SeBackupPrivilege 1052 WMIC.exe Token: SeRestorePrivilege 1052 WMIC.exe Token: SeShutdownPrivilege 1052 WMIC.exe Token: SeDebugPrivilege 1052 WMIC.exe Token: SeSystemEnvironmentPrivilege 1052 WMIC.exe Token: SeRemoteShutdownPrivilege 1052 WMIC.exe Token: SeUndockPrivilege 1052 WMIC.exe Token: SeManageVolumePrivilege 1052 WMIC.exe Token: 33 1052 WMIC.exe Token: 34 1052 WMIC.exe Token: 35 1052 WMIC.exe Token: 36 1052 WMIC.exe Token: SeIncreaseQuotaPrivilege 1052 WMIC.exe Token: SeSecurityPrivilege 1052 WMIC.exe Token: SeTakeOwnershipPrivilege 1052 WMIC.exe Token: SeLoadDriverPrivilege 1052 WMIC.exe Token: SeSystemProfilePrivilege 1052 WMIC.exe Token: SeSystemtimePrivilege 1052 WMIC.exe Token: SeProfSingleProcessPrivilege 1052 WMIC.exe Token: SeIncBasePriorityPrivilege 1052 WMIC.exe Token: SeCreatePagefilePrivilege 1052 WMIC.exe Token: SeBackupPrivilege 1052 WMIC.exe Token: SeRestorePrivilege 1052 WMIC.exe Token: SeShutdownPrivilege 1052 WMIC.exe Token: SeDebugPrivilege 1052 WMIC.exe Token: SeSystemEnvironmentPrivilege 1052 WMIC.exe Token: SeRemoteShutdownPrivilege 1052 WMIC.exe Token: SeUndockPrivilege 1052 WMIC.exe Token: SeManageVolumePrivilege 1052 WMIC.exe Token: 33 1052 WMIC.exe Token: 34 1052 WMIC.exe Token: 35 1052 WMIC.exe Token: 36 1052 WMIC.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1064 wrote to memory of 5684 1064 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe 79 PID 1064 wrote to memory of 5684 1064 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe 79 PID 1064 wrote to memory of 5684 1064 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe 79 PID 5684 wrote to memory of 4648 5684 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe 83 PID 5684 wrote to memory of 4648 5684 2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe 83 PID 4648 wrote to memory of 1052 4648 cmd.exe 85 PID 4648 wrote to memory of 1052 4648 cmd.exe 85 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe"C:\Users\Admin\AppData\Local\Temp\2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E237E729-649E-4EB1-B58C-101B6875447C}'" delete3⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E237E729-649E-4EB1-B58C-101B6875447C}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Adobe\README.txt
- Size 1KB
- SHA256 e81f7ebffbcdcd6abfb37225682f8355728f743b2b9e7eecf59db6f0a92f8db5
- MD5 bf400c4bae262d443ea6641b42de65bd
- SHA1 c93508d3922d39d197f71b0d2ab5bf6e139fd3f2
- SHA512 3e80539426999b0f8616a3fbaea10954811f2ab91bceb011bbb816e9485104cd4db659d9adf9f533572fa36b046f43a1cab45a1fb77813d9d9f10c9959435eec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f.exe
- Size 1.4MB
- SHA256 86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17
- MD5 5c254d25751269892b6f02d6c6384aef
- SHA1 79106dd259ba5343202c2f669a0a61b10adfadff
- SHA512 ebde8f69487bf89570169fad50b494afb8859caf309bc6dde05979881100daebbcd38873277dc45f0108715f70418b3c9364909ec5a8bcb0ec2faac815a2f11e
- SSDEEP 24576:lVN4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yR1:Fo5+fFqgdh02q3ntgNLqw9nwPDC7bODU
- MD5 SHA1 SHA512 SSDEEP